add Ubuntu ESM (Ubuntu Pro) vulnerability matching

Handles Ubuntu ESM as a distro `esm` channel, modeled on the existing RHEL EUS
support. When a scanned Ubuntu image is Pro/ESM-enabled, a two-pass match resolves
base disclosures against the ESM-channel fixes, so users see `fixed in ...+esm1`
instead of a bare wont-fix. Non-Pro scans are unchanged: the same CVEs still show
as vulnerable/wont-fix.

Off by default. Turns on when ESM is detected on the scanned OS or via
`--distro ubuntu:XX.YY+esm`.

This consumes the `ubuntu:XX.YY+esm` records the ubuntu vunnel provider now emits.
No DB schema change: the `os` transformer already splits the channel suffix, same
as RHEL EUS.

Note: the Pro/ESM detection this relies on lives in syft (anchore/syft#5028). The
`syft` dependency here is temporarily pinned to that PR's branch, not a released
version, and needs re-pinning once #5028 merges.

FIPS / Realtime / BlueField Pro tiers are intentionally out of scope for now.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

Author: wagoodman

cmd/grype/cli/commands/root.go

@@ -430,8 +430,9 @@ func getProviderConfig(opts *options.Grype) pkg.ProviderConfig {
 
 func getFixChannels(fixChannelOpts options.FixChannels) distro.FixChannels {
 	// use the API defaults as a starting point, then overlay the application options
-	eusOptions := distro.DefaultFixChannels().Get("eus")
+	defaults := distro.DefaultFixChannels()
 
+	eusOptions := defaults.Get("eus")
 	if eusOptions == nil {
 		panic("default fix channels do not contain Red Hat EUS channel")
 	}
@@ -441,16 +442,34 @@ func getFixChannels(fixChannelOpts options.FixChannels) distro.FixChannels {
 		eusOptions.Versions = version.MustGetConstraint(fixChannelOpts.RedHatEUS.Versions, version.SemanticFormat)
 	}
 
+	esmOptions := defaults.Get("esm")
+	if esmOptions == nil {
+		panic("default fix channels do not contain Ubuntu ESM channel")
+	}
+
+	esmOptions.Apply = distro.FixChannelEnabled(fixChannelOpts.UbuntuESM.Apply)
+	// note: esm's default Versions is nil (no version window); only override when the user explicitly sets one
+	if fixChannelOpts.UbuntuESM.Versions != "" {
+		esmOptions.Versions = version.MustGetConstraint(fixChannelOpts.UbuntuESM.Versions, version.SemanticFormat)
+	}
+
 	return []distro.FixChannel{
 		{
 			// information inherent to the channel (part of the API defaults)
-			Name: "eus",
+			Name: eusOptions.Name,
 			IDs:  eusOptions.IDs,
 
 			// user configurable options
 			Versions: eusOptions.Versions,
 			Apply:    eusOptions.Apply,
 		},
+		{
+			Name: esmOptions.Name,
+			IDs:  esmOptions.IDs,
+
+			Versions: esmOptions.Versions,
+			Apply:    esmOptions.Apply,
+		},
 	}
 }
 

cmd/grype/cli/commands/root_test.go

@@ -66,6 +66,12 @@ func Test_getProviderConfig(t *testing.T) {
 								Apply:    "auto",
 								Versions: version.MustGetConstraint(">= 8.0", version.SemanticFormat),
 							},
+							{
+								Name:     "esm",
+								IDs:      []string{"ubuntu"},
+								Apply:    "auto",
+								Versions: nil,
+							},
 						},
 					},
 				},

cmd/grype/cli/options/fix_channels.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/anchore/clio"
 	"github.com/anchore/grype/grype/distro"
+	"github.com/anchore/grype/grype/version"
 )
 
 type FixChannelEnabled string
@@ -15,6 +16,9 @@ type FixChannels struct {
 
 	// EUS is the Extended Update Support channel for RHEL
 	RedHatEUS FixChannel `yaml:"redhat-eus" json:"redhat-eus" mapstructure:"redhat-eus"`
+
+	// UbuntuESM is the Extended Security Maintenance (Ubuntu Pro) channel for Ubuntu
+	UbuntuESM FixChannel `yaml:"ubuntu-esm" json:"ubuntu-esm" mapstructure:"ubuntu-esm"`
 }
 
 type FixChannel struct {
@@ -40,21 +44,41 @@ func (o *FixChannel) PostLoad() error {
 
 func DefaultFixChannels() FixChannels {
 	rhelEUS := distro.DefaultFixChannels().Get("eus")
-
 	if rhelEUS == nil {
 		panic("default fix channels do not contain Red Hat EUS channel")
 	}
 
+	ubuntuESM := distro.DefaultFixChannels().Get("esm")
+	if ubuntuESM == nil {
+		panic("default fix channels do not contain Ubuntu ESM channel")
+	}
+
 	// use API defaults for the CLI configuration
 	return FixChannels{
 		RedHatEUS: FixChannel{
 			Apply:    string(rhelEUS.Apply),
 			Versions: rhelEUS.Versions.Value(),
 		},
+		UbuntuESM: FixChannel{
+			Apply: string(ubuntuESM.Apply),
+			// note: esm has a nil Versions constraint (no version window), so do not call .Value() on it
+			Versions: constraintValue(ubuntuESM.Versions),
+		},
+	}
+}
+
+// constraintValue returns the string form of a version constraint, tolerating a nil constraint (a channel with no
+// version window, such as Ubuntu ESM).
+func constraintValue(c version.Constraint) string {
+	if c == nil {
+		return ""
 	}
+	return c.Value()
 }
 
 func (o *FixChannels) DescribeFields(descriptions clio.FieldDescriptionSet) {
 	descriptions.Add(&o.RedHatEUS, `whether to always enable, disable, or automatically detect when to use Red Hat Extended Update Support (EUS) vulnerability data`)
 	descriptions.Add(&o.RedHatEUS.Apply, `whether fixes from this channel should be considered, options are "never", "always", or "auto" (conditionally applied based on SBOM data)`)
+	descriptions.Add(&o.UbuntuESM, `whether to always enable, disable, or automatically detect when to use Ubuntu Extended Security Maintenance (ESM / Ubuntu Pro) vulnerability data`)
+	descriptions.Add(&o.UbuntuESM.Apply, `whether fixes from this channel should be considered, options are "never", "always", or "auto" (conditionally applied based on SBOM data)`)
 }

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4
 	github.com/anchore/packageurl-go v0.2.0
 	github.com/anchore/stereoscope v0.2.2
-	github.com/anchore/syft v1.46.0
+	github.com/anchore/syft v1.46.1-0.20260702183437-ba661e83a7e5
 	github.com/aquasecurity/go-pep440-version v0.0.1
 	github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
 	github.com/bitnami/go-version v0.0.0-20250505154626-452e8c5ee607
@@ -339,6 +339,7 @@ require (
 	google.golang.org/grpc v1.80.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	howett.net/plist v1.0.1 // indirect
 	modernc.org/libc v1.72.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -154,8 +154,8 @@ github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T
 github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE=
 github.com/anchore/stereoscope v0.2.2 h1:SGTLGoF6GHmKEn9Bb6LYpzzgz9nhvMZgN/c4fTSQjYY=
 github.com/anchore/stereoscope v0.2.2/go.mod h1:ylJXJKebLctP7u9ewguB1d0zUETJxvAA7r2DiuljDTM=
-github.com/anchore/syft v1.46.0 h1:qIXMOJMlznWsWgzOT6xzK8aDhpOG7wnkbA0BS2UKF0c=
-github.com/anchore/syft v1.46.0/go.mod h1:LwBimjMV20nC1zAsN5jzpGTg/6f0X4Acvvx1WymA53g=
+github.com/anchore/syft v1.46.1-0.20260702183437-ba661e83a7e5 h1:sWURwg0BkDlGUo+lktVFpgPtdy7QqbsrojLnpoYT4ew=
+github.com/anchore/syft v1.46.1-0.20260702183437-ba661e83a7e5/go.mod h1:D2EesMQiokuYW5w5y7tVM4pNYGsaYxqNIImffSSgGnY=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
@@ -651,6 +651,7 @@ github.com/invopop/jsonschema v0.14.0 h1:MHQqLhvpNUZfw+hM3AZDYK7jxO8FZoQeQM77g8i
 github.com/invopop/jsonschema v0.14.0/go.mod h1:ygm6C2EaVNMBDPpaPlnOA2pFAxBnxGjFlMZABxm9n2I=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -1560,6 +1561,7 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/ini.v1 v1.66.2/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
+gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1584,6 +1586,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
+howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
 modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
 modernc.org/ccgo/v4 v4.34.0 h1:yRLPFZieg532OT4rp4JFNIVcquwalMX26G95WQDqwCQ=

grype/db/v6/build/transformers/os/transform_test.go

@@ -1103,6 +1103,21 @@ func TestGetOperatingSystem(t *testing.T) {
 				Channel:      "eus",
 			},
 		},
+		{
+			name:      "includes channel (ubuntu esm), preserves zero-padded minor",
+			osName:    "ubuntu",
+			osID:      "ubuntu",
+			osVersion: "22.04",
+			channel:   "esm",
+			expected: &db.OperatingSystem{
+				Name:         "ubuntu",
+				ReleaseID:    "ubuntu",
+				MajorVersion: "22",
+				MinorVersion: "04",
+				Codename:     "jammy",
+				Channel:      "esm",
+			},
+		},
 	}
 
 	for _, tt := range tests {
@@ -1192,6 +1207,16 @@ func TestGetOSInfo(t *testing.T) {
 				channel: "eus",
 			},
 		},
+		{
+			name:  "ubuntu + esm",
+			group: "ubuntu:22.04+esm",
+			expected: osInfo{
+				name:    "ubuntu",
+				id:      "ubuntu",
+				version: "22.04",
+				channel: "esm",
+			},
+		},
 	}
 
 	for _, tt := range tests {

grype/db/v6/operating_system_store_test.go

@@ -19,6 +19,8 @@ func TestOperatingSystemStore_ResolveOperatingSystem(t *testing.T) {
 
 	ubuntu2004 := &OperatingSystem{Name: "ubuntu", ReleaseID: "ubuntu", MajorVersion: "20", MinorVersion: "04", LabelVersion: "focal"}
 	ubuntu2010 := &OperatingSystem{Name: "ubuntu", MajorVersion: "20", MinorVersion: "10", LabelVersion: "groovy"}
+	ubuntu1604 := &OperatingSystem{Name: "ubuntu", ReleaseID: "ubuntu", MajorVersion: "16", MinorVersion: "04", LabelVersion: "xenial"}
+	ubuntu1604esm := &OperatingSystem{Name: "ubuntu", ReleaseID: "ubuntu", MajorVersion: "16", MinorVersion: "04", LabelVersion: "xenial", Channel: "esm"}
 	rhel8 := &OperatingSystem{Name: "rhel", ReleaseID: "rhel", MajorVersion: "8"}
 	rhel81 := &OperatingSystem{Name: "rhel", ReleaseID: "rhel", MajorVersion: "8", MinorVersion: "1"}
 	debian10 := &OperatingSystem{Name: "debian", ReleaseID: "debian", MajorVersion: "10"}
@@ -40,6 +42,8 @@ func TestOperatingSystemStore_ResolveOperatingSystem(t *testing.T) {
 	operatingSystems := []*OperatingSystem{
 		ubuntu2004,
 		ubuntu2010,
+		ubuntu1604,
+		ubuntu1604esm,
 		rhel8,
 		rhel81,
 		debian10,
@@ -75,6 +79,25 @@ func TestOperatingSystemStore_ResolveOperatingSystem(t *testing.T) {
 			},
 			expected: []OperatingSystem{*ubuntu2004},
 		},
+		{
+			name: "base ubuntu query returns only the vanilla (non-esm) channel row",
+			os: OSSpecifier{
+				Name:         "ubuntu",
+				MajorVersion: "16",
+				MinorVersion: "04",
+			},
+			expected: []OperatingSystem{*ubuntu1604}, // important! the +esm row is NOT returned
+		},
+		{
+			name: "ubuntu esm channel query returns only the esm row",
+			os: OSSpecifier{
+				Name:         "ubuntu",
+				MajorVersion: "16",
+				MinorVersion: "04",
+				Channel:      "esm",
+			},
+			expected: []OperatingSystem{*ubuntu1604esm}, // important! the base row is NOT returned
+		},
 		{
 			name: "specific distro with major and minor version (missing left padding)",
 			os: OSSpecifier{

grype/distro/distro_test.go

@@ -270,6 +270,51 @@ func Test_NewDistroFromRelease(t *testing.T) {
 			major: "9",
 			minor: "4",
 		},
+		{
+			name: "esm hinted at as attribute (ubuntu pro), nil version window applies",
+			release: linux.Release{
+				ID:              "ubuntu",
+				Version:         "16.04",
+				ExtendedSupport: true,
+			},
+			channels: testFixChannels(),
+			expected: &Distro{
+				Type:     Ubuntu,
+				Version:  "16.04",
+				Channels: names("esm"),
+			},
+			major: "16",
+			minor: "04",
+		},
+		{
+			name: "esm not applied for non-pro ubuntu (auto, no extended support)",
+			release: linux.Release{
+				ID:      "ubuntu",
+				Version: "16.04",
+			},
+			channels: testFixChannels(),
+			expected: &Distro{
+				Type:    Ubuntu,
+				Version: "16.04",
+			},
+			major: "16",
+			minor: "04",
+		},
+		{
+			name: "esm embedded in the version",
+			release: linux.Release{
+				ID:      "ubuntu",
+				Version: "16.04+esm",
+			},
+			channels: testFixChannels(),
+			expected: &Distro{
+				Type:     Ubuntu,
+				Version:  "16.04",
+				Channels: names("esm"),
+			},
+			major: "16",
+			minor: "04",
+		},
 		{
 			name: "v versionID prefix postmarketos",
 			release: linux.Release{

grype/distro/fix_channel.go

@@ -49,6 +49,14 @@ func DefaultFixChannels() FixChannels {
 			Apply:    ChannelConditionallyEnabled,
 			Versions: version.MustGetConstraint(">= 8.0", version.SemanticFormat),
 		},
+		{
+			Name:  "esm",
+			IDs:   []string{"ubuntu"},
+			Apply: ChannelConditionallyEnabled,
+			// nil is deliberate: esm-apps covers universe for the full support window (including in-support
+			// years), so there is no version gate like RHEL EUS. applyChannels already guards Versions != nil.
+			Versions: nil,
+		},
 	}
 }
 

grype/distro/fix_channel_test.go

@@ -11,14 +11,20 @@ import (
 func TestDefaultFixChannels(t *testing.T) {
 	channels := DefaultFixChannels()
 
-	// this seems like a silly test, however, it is critical to ensure that the default channels have EUS with expected values
+	// this seems like a silly test, however, it is critical to ensure that the default channels have EUS and ESM with expected values
 	expected := FixChannels{
 		{
 			Name:     "eus",
 			IDs:      []string{"rhel"},
 			Apply:    ChannelConditionallyEnabled,
 			Versions: version.MustGetConstraint(">= 8.0", version.SemanticFormat),
 		},
+		{
+			Name:     "esm",
+			IDs:      []string{"ubuntu"},
+			Apply:    ChannelConditionallyEnabled,
+			Versions: nil, // deliberate: no version window for ESM (esm-apps covers universe for the full support window)
+		},
 	}
 
 	if diff := cmp.Diff(expected, channels); diff != "" {